101 about biscuit token https://github.com/CleverCloud/biscuit

1. Biscuit, the cryptotoken you
can share safely with your
APIs
By @gcouprie & @waxzce from @clever_cloud

2. Geoffroy
COUPRIE
@gcouprie
R&D engineer at Clever Cloud

3. Quentin ADAM
@waxzce
CEO at Clever Cloud

4. What is ?
Automation of infrastructure to provide developer velocity,
higher quality and uptime,
reduce costs and save time
So, it’s the cloud promise, delivered
On cloud or on premise
Try it https://www.clever-cloud.com/

6. Native support for many API gateway
https://maif.github.io/otoroshi/

7. Native support for many API gateway
https://gravitee.io/

8. Clever Cloud is API first
https://www.clever-cloud.com/doc/api/#!/all/_openapi_get
And Web Component too ;-)

9. What is a biscuit?
How did it evolve since last year?
https://github.com/CleverCloud/biscuit

10. Microservice authentication: decentralized

11. We already solve that with JWT...

12. UPGRADE IT

13. First, JWT token is fat. We need to reduce it
Biscuit uses protocol buffers as encoding and a
symbol table (like hpack) to reduce the size

14. ACL

18. But, what is an admin right?

19. Identity != Rights

20. Biscuit have a real ACL management
built in

21. Datalog

22. Datalog:
a logical language

23. Ask the biscuit for each action:
Can I do That? (for example read file a.txt)
Yes
No

24. Ask the biscuit for each action:
Can I do That? (for example read file a.txt)
Yes
No
Yes, BUT (add some filter)

25. Ask the biscuit for each action:
Can I get access to all your github repositories?
Yes
No
Yes, BUT only those tagged “dev”

26. Show me
https://play-with-biscuit.cleverapps.io/

27. Why it’s so cool?
● Make rights not based on role but fully flexible
● Looking at the token give you intel about what you can do with it
● UI can know the right and change the behavior

28. Attenuation

29. Ability to share a same or smaller token
than mine

30. Unpossible to remove a block when it’s
append

31. Clever Crypto:
Aggregated Gamma Signatures
https://eprint.iacr.org/2018/414

32. Show me
https://play-with-biscuit.cleverapps.io/

33. Can I use it? Fully open source and free
● Specification is right there https://github.com/CleverCloud/biscuit
● Implementations:
○ Rust https://github.com/CleverCloud/biscuit-rust (FFI soon)
○ Rust + WASM (webassembly), browser compatible https://github.com/CleverCloud/biscuit-
wasm
○ Java https://github.com/CleverCloud/biscuit-java
● Real world:
○ Soon Clever Cloud API
○ Pulsar https://github.com/CleverCloud/biscuit-pulsar
○ Warp10 soon
more ?
https://github.com/CleverCloud?utf8=%E2%9C%93&q=biscuit&type=&language=

34. Thanks!
Give Clever Cloud a try and play with biscuit
By @gcouprie & @waxzce from @clever_cloud